Security Of Critical Infrastructure – Adoption Of Cyber Security Framework And Mandatory Reporting Deadline Approaches While The Regulator Moves From "Education" To "Enforcement" Mode

Some key compliance dates approach for responsible entities of critical infrastructure assets under the Security of Critical Infrastructure Act (SOCI Act).

First, from 17 August 2024 responsible entities required to have in place a Critical Infrastructure Risk Management Program (CIRMP) must comply with one of the following cyber security frameworks:

• ISO 27001;
• Essential Eight maturity level one;
• NIST's Framework for Improving Critical Infrastructure Cybersecurity;
• Maturity Indicator Level 1 of the US Department of Energy's Cybersecurity Capability Maturity Model;
• Security Profile 1 of the 2020-21 AESCSF Framework Core; or
• an equivalent framework.

Second, by 28 September 2024 responsible entities must submit mandatory annual reports on CIRMPs that operated in the 2023/24 financial year. Previously, annual reports were not mandatory but could be voluntarily submitted, with CISC receiving 27 reports last year.